An underappreciated downside of the US allowing Chinese firms to rent the equivalent of a million or more AI chips overseas is that it creates a major smuggling risk.
One argument, made in a RAND commentary, for this remote access (as opposed to direct sales of chips into China) is that it creates optionality for the US to cut off or otherwise alter this access in the future. Since the chips remain in jurisdictions outside China, the US retains some control over their use, especially when, as that argument went, they are rented out by US cloud providers.
But remote access now appears to create future liabilities for the US rather than optionality. More and more chips are being sold to untrusted cloud service providers that look less like independent firms than like off-balance-sheet vehicles for Chinese hyperscalers. That is concerning for two reasons:
If these firms, dominated by Chinese interests, no longer expect further NVIDIA shipments, they are likely to try to move their chips into China.
Buying chips for legal overseas rental can create cover for diverting some of them into China and help firms build networks of shell companies that let large-scale smuggling go undetected.
The clearest example is Megaspeed. Revelations about NVIDIA’s then-CEO Jensen Huang, related to his relationship with Alice Huang, an apparent Chinese intelligence asset who was a senior executive at Megaspeed (which we wrote about earlier this week), have now led to his resignation. They also prompted a large volume of investigative reporting on Megaspeed’s dealings with NVIDIA. Megaspeed appears to be a front company for servicing Chinese demand for restricted US AI hardware.
Megaspeed got its first meeting with NVIDIA to seek chip allocations only because it could show a contract from Alibaba. Alibaba was its anchor customer and remains its largest, likely renting the vast majority of its capacity. Alibaba also lent to Megaspeed through subsidiaries, while the company’s balance sheet ballooned from $33 million to $3 billion between 2023 and 2024. At one point, Megaspeed’s subsidiary Speedmatrix pledged its entire business as collateral to an Alibaba subsidiary. The Institute for Progress (IFP) estimates that Megaspeed is renting about 82,000 H100-equivalents (H100e) to Alibaba and other Chinese customers,1 most likely in data centers outside China. Megaspeed has reportedly purchased more than $4.8 billion of NVIDIA chips since 2024.
Although NVIDIA has claimed that Megaspeed is “wholly owned and operated by a company based and headquartered outside China, with no China shareholders”, the company exists only because of Chinese financing and demand, and in effect acts as an off-balance-sheet vehicle for Alibaba to access restricted AI chips.
Worse, Megaspeed has been tied more directly to AI chip smuggling into China. A Bloomberg investigation found that NVIDIA’s inventory checks, as relayed to the US government, counted 50,000 fewer chips than trade records showed it had sold to Megaspeed. (NVIDIA later said it had identified “substantially” all of the chips in other Megaspeed warehouses, but offered no numbers.) NVIDIA promised to carry out follow-up visits, but has since declined to say whether it has done so. The Information later reported that Alice Huang also worked with her husband and sister through networks of companies to directly smuggle chips into China, including potentially to DeepSeek. Bloomberg has then produced even more conclusive evidence tying Alice Huang and Megaspeed to Chinese shell companies that handled smuggled GPUs.
Megaspeed is not just one bad actor but part of a wider network. The firm has been linked by short seller Culper Research, through common addresses and an almost identical website, to Novagate, which may host tens of thousands more restricted chips. It has also been tied to YTL AI Cloud, which is building a $4.3 billion data center in Malaysia, and connected to OBON, which was party to the alleged large-scale smuggling of Supermicro servers. The broader pattern of small cloud service providers across Asia that depend on a few Chinese hyperscale customers is concerning and extends to other firms such as Aolani Cloud and Japan’s Datasection.2
US leverage over these firms rests almost exclusively on their desire to keep receiving NVIDIA chips. By contrast, cloud service providers such as Microsoft and Oracle are far lower risk. They have good records of corporate governance, and the US has jurisdiction over them. They would also have more to lose from shedding their corporate identities or violating US export controls. That isn’t true of a firm such as Megaspeed, which exists to service Chinese demand for advanced AI chips. If it no longer expects new shipments,3 its likely next step is to smuggle its existing pool into China and rent it out at a large premium. Contracts for Blackwell servers that the AI developer Moonshot reportedly rented inside China valued them at a markup of about 350% on the going rate in the US.
The risk of this smuggling grows with the volume of chips sold into Southeast Asia to service Chinese demand, since firms such as Megaspeed could move quickly from rental to smuggling. IFP expects Chinese remote access to nearly triple, from 1 million H100e at the end of 2026 to 2.8 million by the end of 2027.4 For comparison, Epoch AI estimates that OpenAI had access to 1.7 million H100e at the end of 2025, and Anthropic 1.2 million. The number of chips smuggled into China up to June 2026 is probably also about 1.2 million H100e. Compute on this scale is highly relevant to the frontier of AI development and deployment.
The larger this remote access grows, the more difficult and disruptive a rule to rein it in will be. Vested interests in the status quo, whether NVIDIA, cloud service providers, or Southeast Asian governments, will have greater resources and leverage to argue against a prohibition. Cutting off Chinese end users from a larger pool of chips also increases the impact on global chip prices. Anthropic or OpenAI can easily rent tens to low hundreds of thousands of chips at short notice,5 but once the pool scales towards millions, sharper questions arise about liquidity and how such rentals would fit with wider compute commitments. A chip that is rented immediately to Anthropic at a lucrative markup is less likely to be diverted than one caught in six months of revenue-free limbo.
This potential smuggling matters not just for Chinese circumvention of US export controls but also for future international agreements on AI. Most proposed agreements assume that the US, China, and other states will cooperate to track down all the world’s AI-relevant chips and verify that they are not supporting restricted AI activities. Reducing unverified “dark compute” is key to building the trust needed to make these agreements work. Large volumes of advanced chips entering gray-market smuggling networks in China and across Southeast Asia undermine that effort.
The US can act now to keep uncontrolled Chinese remote access from snowballing into a large pool of chips at high risk of being smuggled. The simplest step is to bar NVIDIA from doing business with Megaspeed, but that alone is not enough. A whole ecosystem of similar firms in Southeast Asia depends on the loophole in US export controls that allows remote access to otherwise restricted chips. The priority should be a new rule governing China’s remote access to chips overseas. Cassia and Onni recently published a report on how the Bureau of Industry and Security can use its existing powers to issue such a rule, which would prohibit Chinese AI developers from accessing compute at the scale needed to train and run frontier AI models.
NVIDIA has reportedly taken limited steps to address these issues, such as starting a voluntary program with its Southeast Asian partners to enable technical location-tracking features, and trimming its whitelist of pre-approved buyers. While these may help, they are far from a complete solution. Above all, the US needs to close the remote access loophole, blocking the huge flow of chips to untrusted firms. It can pair this with:
Adopting more effective anti-smuggling mechanisms, such as chip tracking, stricter whitelists, and whistleblower rewards
Working with governments and firms to ensure chips quickly find non-Chinese buyers
Together, these would keep any diversion after the restriction to a minimum. Even with some leakage, restricting remote access would be well worth doing, since it would deny Chinese firms an even greater pool of more advanced chips that would be at similar risk of diversion.
An H100-equivalent is the computing power of one NVIDIA H100, an AI chip released in 2022. IFP and Epoch AI’s calculations of H100e differ somewhat from those we typically use at The Substrate, which are based on Total Processing Performance (TPP). For example, a B200 counts as about 2.5 H100e in Epoch AI’s data, and about 2.25 by TPP. The figures used in this piece reflect the FP8 convention used by IFP and Epoch.
Aolani is more directly linked to Megaspeed, as both had been purchasing servers from Aivres, the US subsidiary of the entity-listed Chinese firm Inspur, though Aolani serves demand from ByteDance rather than Alibaba. Datasection has inked a number of large deals with Tencent covering data centers in Japan and Australia. It is lower risk but still new to data center infrastructure and has a single large customer.
It is unclear whether Megaspeed has stopped receiving chips. NVIDIA has claimed that it stopped sales to Megaspeed in June 2025, but the New York Times has reported that NVIDIA continues to do business with the firm.
A significant chunk of this capacity, hundreds of thousands of H100e, sits with Oracle, a lower-risk actor, but that still leaves a large quantity flowing towards untrusted firms.
For example, Anthropic’s and Google’s short-term rentals from SpaceX are on this scale: 220,000 GPUs for Anthropic and 110,000 for Google. Both were agreed on 90-day cancellation terms. If Southeast Asian capacity were pushed onto the market, I’d expect it to meet a looser market, given the supply coming online in 2027, and probably to be negotiated on a longer term and at a lower premium to reduce upfront payment pressure. Other sticking points would be legal or security concerns, but I’m confident these could be resolved.